Medium 6.5

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media...

CVE-2026-121259 First seen on SecPulse Nov 4, 01:30

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Red Hat	Red HatRed Hat Enterprise Linux 10	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 7	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 9	—	Not listed
GitLab	GitLabgst-plugins-bad	< 1.28.2→ 1.28.2	1.28.2

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Debian DEBIAN-CVE-2026-121259 gst-plugins-bad1.0 Fix available
Ubuntu UBUNTU-CVE-2026-121259 gst-plugins-bad1.0 No fixed version in this record

Original description The description as published by the source.

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Nov 4, 2026
First seen on SecPulse: Nov 4, 01:30
GHSA: GHSA-w42h-xjfh-x8j5
CWE: CWE-190

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

CWE-190

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Gst Plugins Bad

Detection sources

NIST National Vulnerability DatabaseNov 7, 13:17
GitHub Security Advisories (Global)Nov 4, 03:31
CVE.org (CVE Program・cvelistV5)Nov 7, 12:15